PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH .
A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH .
The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a privileged attacker to achieve arbitrary write or delete files via specifically crafted arguments to existing commands.
Cybersecurity and Infrastructure Security Agency (CISA), on October 16, 2026, added CVE-2025-61624 to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring federal agencies to apply the fixes by October 19, 2026.
It includes an auto-script designed to download five components from an external server ("23.240.77[.]233:8085") - The main phase of the attack begins after an execution delay.
However, Unit 42 emphasized that exploiting these vulnerabilities requires the device to be enrolled in FortiGate Cloud/FortiCloud SSO, which none of the affected firewalls held.
Some of the harvested details are listed below - The stolen information was then used to conduct network reconnaissance, establish long-term access, intercept network traffic, set up unauthorized FortiGate SSL/VPN sessions to perimeter firewalls, deploy backdoors, and exploit a separate privilege-escalation vulnerability (i.e., CVE-2025-61624) to deploy PEERSTITCH.
The multi-stage network intrusion is being tracked as CL-STA-0954 (aka UNC5820 ), with initial access obtained by exploiting a critical Fortinet FortiManager flaw dubbed FortiJump (CVE-2024-47575).
The malware is a 64-bit Linux ARM64 executable written in C.
Following a successful compromise of the appliance, the attackers are said to have exfiltrated an archive containing running configurations, cryptographic material, and database files containing information about more than 500 managed FortiGate firewalls.
This includes two specific markers - Once this pattern is identified, it passes the associated session token or identifier to the iked daemon, whose hook later looks for that identifier while handling subsequent VPN sessions.
What happened
A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH .
The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a privileged attacker to achieve arbitrary write or delete files via specifically crafted arguments to existing commands.
What changed
Cybersecurity and Infrastructure Security Agency (CISA), on October 16, 2026, added CVE-2025-61624 to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring federal agencies to apply the fixes by October 19, 2026.
Who is affected
It includes an auto-script designed to download five components from an external server ("23.240.77[.]233:8085") - The main phase of the attack begins after an execution delay.
However, Unit 42 emphasized that exploiting these vulnerabilities requires the device to be enrolled in FortiGate Cloud/FortiCloud SSO, which none of the affected firewalls held.
Why it matters
Some of the harvested details are listed below - The stolen information was then used to conduct network reconnaissance, establish long-term access, intercept network traffic, set up unauthorized FortiGate SSL/VPN sessions to perimeter firewalls, deploy backdoors, and exploit a separate privilege-escalation vulnerability (i.e., CVE-2025-61624) to deploy PEERSTITCH.
The multi-stage network intrusion is being tracked as CL-STA-0954 (aka UNC5820 ), with initial access obtained by exploiting a critical Fortinet FortiManager flaw dubbed FortiJump (CVE-2024-47575).
Technical details
The malware is a 64-bit Linux ARM64 executable written in C.
Following a successful compromise of the appliance, the attackers are said to have exfiltrated an archive containing running configurations, cryptographic material, and database files containing information about more than 500 managed FortiGate firewalls.
This includes two specific markers - Once this pattern is identified, it passes the associated session token or identifier to the iked daemon, whose hook later looks for that identifier while handling subsequent VPN sessions.
Response
The orchestrator ("ipssem.js") launches "lldprx," which then serves as a process memory patching injector targeting two core FortiOS daemons: "/bin/miglogd" and "/bin/iked." Specifically, it locates the running processes associated with the two daemons, enumerates their memory layout, attaches to them using ptrace and halts their execution using PTRACE_INTERRUPT, allocates executable memory and writes malicious code into it, and redirects execution through the injected code.
Besides deploying PEERSTITCH, the attackers have been observed establishing a separate command-and-control (C2) channel by leveraging the native Apache "mod_md" module on FortiGate firewalls to spawn an SSH-based reverse shell.
Attribution
The Hacker News: A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH .
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.